Configuring protocol transition is straightforward.
In Figure 3, beneath the Trust this user
for delegation to specified services only option
are two radio buttons that let you select either
Use Kerberos only or Use any authentication protocol. If you select Use Kerberos only, then constrained
delegation will work only with inbound
Kerberos authentication of the user. Selecting Use any authentication protocol, which Figure
3 shows, lets you use protocol transition so that
the middle-tier application (MOSS, in this case)
changes the incoming authentication to Kerberos
from some other authentication protocol,
such as Basic authentication or NTLM.
For the service to obtain an impersonation
token, its service account must have the “act
as part of the operating system” privilege. If it
doesn’t, the service will get only an identification
token.
Getting an impersonation token is essential
if your goal is to allow both protocol transition
and delegation. However, the impersonation
token does expose your system to attacks where
a user logs on as the application pool account
to compromise a system. Therefore, use this
feature with caution.
An identity token, however, is usually adequate
if all you need is to allow protocol transition.
See Web Figure 2 to get a picture of what it
takes to support protocol transition. The Learning
Path that appears with this article online
directs you to more resources about protocol
transition and Kerberos. After you configure
Kerberos, you’ll need to check out the Web sidebar
“Testing and Troubleshooting Kerberos,”
InstantDoc ID 97378, to ensure you’ve done it
correctly.
Get to Know the Three-Headed
Watchdog
As you can see, Kerberos authentication in a
MOSS environment is a significant and sometimes
challenging topic. Small wonder that
it’s named for the three-headed dog in Greek
mythology that guarded the gates of the underworld.
But, with a little research, perseverance,
and some testing in your lab environment,
you’ll soon gain experience with the threeheaded
dog and hopefully let it loose on your
MOSS portal. We recommend you try it!
End of Article
SCG December 18, 2007 (Article Rating: